Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/03/2024, 21:56
Behavioral task
behavioral1
Sample
cn700_ASwfer_v0.11/ASwfer.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cn700_ASwfer_v0.11/ASwfer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
cn700_ASwfer_v0.11/res/ASWF.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
cn700_ASwfer_v0.11/res/ASWF.bat
Resource
win10v2004-20240226-en
General
-
Target
cn700_ASwfer_v0.11/ASwfer.exe
-
Size
221KB
-
MD5
3a056e7cb2faa6fba592632c3fcf2fd7
-
SHA1
f7d575af7f2b0854b7aa60a6bac9b2caa67175b8
-
SHA256
2cbc4e5f39322c2b50ddc740a3228d8474054e7f6516e5fd5669ca9faeb553f9
-
SHA512
3093909039fe159af7043688edc72e3416976af1394dae04bd12a9ade473f77207c73f00f17990cc74f5317e73d695800e7ed6a10188f67a03bc3c790b585629
-
SSDEEP
6144:HX5z3QlfKOQdKXwRCd5JBF1NhOZv2I54N3qB:HpbmKHdNoJV/qP54NG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1144 2276 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1144 2276 ASwfer.exe 28 PID 2276 wrote to memory of 1144 2276 ASwfer.exe 28 PID 2276 wrote to memory of 1144 2276 ASwfer.exe 28 PID 2276 wrote to memory of 1144 2276 ASwfer.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cn700_ASwfer_v0.11\ASwfer.exe"C:\Users\Admin\AppData\Local\Temp\cn700_ASwfer_v0.11\ASwfer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 4042⤵
- Program crash
PID:1144
-